GDPR.ME.UK · WORKING DOCUMENT 74

Breach decision, notification and response record

Open this record as soon as an incident is identified. Log facts, timestamps, decisions and actions as they become known. Use a real incident response lead; a worksheet cannot monitor or submit a notification for you.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Use alongside the personal data breaches guide and evidence-to-action method.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Establish the incident and awareness timeline

Record discovery, escalation and the point at which the controller became aware, with timezone and evidence. Do not wait for a complete forensic investigation to consider awareness.
Identify confidentiality, integrity and availability impacts, affected systems and whether personal information is involved.
Assign an incident lead, deputy and decision authority; preserve evidence securely.

Incident ID / lead / deputy

Discovery date and time / timezone

Controller awareness date and time / evidence

72-hour notification milestone if applicable

Incident type / systems / initial facts

Evidence preservation and access record

2. Contain and assess impact on people

Record containment, recovery and supplier actions with times and responsible people.
Assess affected data, numbers, vulnerability, sensitivity, identifiability, protection measures, likely misuse and other harms.
Separate established facts from assumptions. Reassess as evidence develops.

Affected data and approximate people / records

Categories of people and vulnerability

Likely consequences / likelihood / severity

Security protections and effectiveness

Containment and recovery actions

Uncertainty / enquiries / reassessment time

3. Decide and record regulator notification

Notify without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk people’s rights and freedoms.
Record the reasoned decision, including reasons not to notify. Record all personal data breaches.
Prepare nature, scale, contact point, likely consequences and mitigation information. If information is incomplete, consider an initial report and phased updates without undue further delay.

Notify / do not notify / review pending

Risk assessment and decision reasons

Decision maker / time / advice

Notification content and submission evidence

Reason for delay if any

Supplementary updates and reference numbers

4. Decide affected-person communication

Assess the high-risk threshold separately from regulator notification. Communicate without undue delay where required.
Consider Article 34 exceptions on the actual facts and document any reliance. Disproportionate effort may require an equally effective public communication.
Use clear language explaining the breach, likely consequences, measures, practical protective steps and contact route.

High-risk assessment

Direct communication required? Rationale

Any Article 34 exception and evidence

Audience / method / accessibility

Approved wording and practical advice

Issue date / delivery evidence / follow-up

5. Coordinate other notifications

A processor must notify its controller without undue delay under Article 33(2); record contractual escalation routes.
Check insurance, sector, customer and other contractual obligations. Coordinate appropriate cyber-response or crime reporting without delaying GDPR decisions.
Maintain a single contact log so parallel communications remain consistent.

Controller / processor role and contacts

Processor notification time and evidence

Insurer and contractual deadlines

Other reporting routes and reasons

Communications owner and contact log

Advice and decision references

6. Learn, close and exercise

Record root cause, final impact, remedial actions and verification. Define what remains open.
Update training, contracts, technical controls and procedures as warranted.
For a tabletop exercise, mark the scenario as simulated, record participants and test escalation, decisions and timing without sending real notifications.

Root cause and final assessment

Improvement action / owner / target date

Verification and closure decision

Evidence retention and access

Exercise or live-incident designation

Next exercise / review date

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.